Disparities in the Implementation of Risk Management in the SMEs

Abstract

This article aims to determine the disparities between SMEs in management and risk management depending on the type of management, age, and size of SMEs in the business environment of Slovakia. The case study was conducted in 2019/2020 on a sample of 362 owners and top managers of SMEs. The hypotheses were verified using statistical methods—the Pearson chi-squared test and the Z-test. The results show that SMEs are more involved in risk management than microenterprises. Process-driven SMEs largely perceive market risk. Medium-sized enterprises perceive personnel risk more intensely than microenterprises and small enterprises. Not even one out of every five owners or top managers can manage risks, and more than 15% of SMEs do not conduct any risk management activities. Financial reserves and insurance are the most used risk reduction measures in SMEs. The purpose of the survey is to strengthen the resilience of SMEs and to find out the causes of the weakening of resilience concerning the investigated risk factors. The creation of integrated management systems presupposes the inclusion of the risk management system among other management systems. By implementing risk management, it is possible to increase the efficiency of management systems.

1. Introduction

The current business environment is constantly changing and depends on various conditions and requirements. Risk has become a crucial part of enterprises and has affected a wide range of organizations in all sectors [1]. Every business that strives to survive, develop, and be sustainable must be prepared to face all the challenges posed by today’s turbulent and uncertain times [2]. The development of small and medium-sized enterprises (SMEs) can also be seriously threatened by financial constraints [3]. All types and sizes of businesses face external and internal risks that make it uncertain whether their business will be successful [2]. More than 70% of SMEs struggle with a lack of sustainability and do not survive more than five years [4].

Entrepreneurship plays an important role in the development of the economy and society [5]. Today, SMEs are increasingly important for job creation and economic growth at the national and European levels. Due to the growing complexity of SMEs, their importance for world economies is also growing [6]. Not only do SMEs contribute to a country’s economic development, but their level of success also acts as a measure of the effectiveness of government policy in developing an entrepreneurial culture in the economy [7]. SMEs represent 99% of enterprises in the European Union (EU). They provide two-thirds of the jobs in the private sector and contribute to more than half of the total benefits created by businesses in the EU.

SMEs are considered key economic drivers in the world and account for the vast majority of global economic performance [8]. For that, promoting the sustainability of SMEs is vital to the entire economy. Risks are also a very important part of the business environment; if risks are well managed, enterprises can provide a higher level of competitiveness and sustainability [9]. Risk management is intended as a process of identifying and assessing risk and applying specific methods to reduce risks to an acceptable level [10]. Effective risk management is a key element of any successful management strategy. Risk management is a systematic process that helps organizations understand the nature of risk and the appropriate ways to assess and control it [11]. Undoubtedly, the biggest obstacle in effective risk management is the fact that it applies to future events that cannot be predicted by default. Decision-makers can only try to estimate the probability of their occurrence and the extent of their consequences and plan preventive measures on this basis [12].

The aim of the article is to identify the disparities between SMEs in management and risk management depending on the type of management, age and size of SMEs in the business environment of the Slovak Republic. The entrepreneurial environment in the Slovak Republic was selected due to the preferred area of focus of the authors, in which they orientate themselves and devote themselves also within the framework of other surveys. The purpose of the survey is to strengthen the resilience of SMEs and to find out the causes of the weakening of resilience concerning the investigated risk factors. The authors of the article expect statistically significant disparities in SME management with regard to the type of SME management, age and size of the enterprise (hereinafter referred to as the research criteria).

The research problem is to find answers to research questions and to strengthen existing findings to bridge the knowledge gap in solving problems focused on the ability of SMEs to manage business risks in specific conditions and to specify key risks for SMEs and opportunities to reduce them.

The benefit of the article is that it performs comparative analysis of the perception of management and risk management among selected groups of owners and top managers according to the type of management, age, and size of the enterprise. We consider the solution of this issue to be very important from the point of view of the sustainability of SMEs in order to secure the economy within countries in the world as well as the world economy. The risks faced by SMEs can affect their operability, which can mean a disruption of the world economy and a slowdown in market activities. Several different surveys have already been carried out within this issue, but the significance of the study is to emphasize the importance of solving the given issue for the enrichment of theoretical contributions as well as the highlighting of shortcomings and gaps in business in various areas.

The structure of the remainder of this article has the following form. The next section of the article contains the theoretical basis of the defined issues of risk management and business management. The results of case studies focused on disparities between selected groups of respondents in Central European countries are also presented. The methodology presents a detailed description of the primary data collection; its time; and the content, technical and quantitative characteristics. This section also contains the methods and demographic structure of a selected sample of SMEs. The next section shows the most important results aimed at evaluating statistical hypotheses and includes case studies conducted in the past. The final section contains a summary of the results, the limitations of the research, and the direction and focus of the future scientific publishing activities of the authors.

2. Theoretical Background

Currently, the trend is to connect individual management systems and create a joint plant. The efforts of enterprises point to the current trend, which forces enterprises to connect individual management systems and thereby create a common base. At the same time, this creates pressure from various interested parties to meet the requirements of management systems [13]. The creation of integrated management systems presupposes the inclusion of the risk management system among other management systems.

Many small businesses are unable to support risk management activities due to a lack of resources and capabilities [14]. Krüger [15] published that SME owners have a risk management concept; however, their knowledge is generally limited to crisis management compared to best practice standards. Because they lack managerial complexity expertise or the resources necessary to effectively manage risk, Torkkeli [16] contends that most SME owners rely on their personal experience rather than on comprehensive and well-structured standards such as those established by the International Organization for Standardization (ISO). Because some SME owners rely on their own experience, in many cases, they perform unsystematically more functions in the business, leading to the unequal application of risk responses in the organization [17].

In Slovakia, the ISO 31000 Risk Management standard is currently most commonly used, and from the point of view of risk assessment techniques, the IEC 31010:2019 Risk management—Risk assessment techniques standard is applied. Considering the needs of SMEs, the ISO 31000 standard—Risk management—A practical guide for SMEs has been created, which gives hands-on guidance on how to make the most of ISO 31000:2009, the International Standard on risk management processes, and integrate good practices in both their strategic decisions and their day-to-day operations [18,19].

According to Hudáková [19], in combination with the quality management system (ISO 9001), the environmental management system (ISO 14001), and the occupational health and safety system (ISO 45001) in connection with the risk management system (ISO 31000), which together form an integrated management system, it is possible to achieve the integration of management systems and they will become a functional management tool (Figure 1). Organizations will create a system to ensure risk prevention within the organization’s activities.

The application of the risk management process to large enterprises is related to their business interests, strategic goals as well as background and their very activities, etc. Considering SMEs, standards are not often used in this area. They are used to a limited extent, as everything depends on the possibilities and resources of the companies themselves, as well as their field of focus. Therefore, even the use of standards in the area of risk management within SMEs has a recommendatory nature [19].

An increase in losses and the emergence of risks could cause a disruption in the operability of SMEs, which would also undermine the very sustainability of SMEs. SMEs play an important role in the development of the economy and society. The ideal goal of risk management is to minimize excessive risks to achieve more favorable results. Minimizing excessive risks is highly beneficial for established enterprises and especially critical for SMEs, especially in the first five years of their operations.

With regard to the Visegrad Group (V4) whose countries belong to the EU (Slovakia, the Czech Republic, Poland, and Hungary), the V4 countries have adopted the definition of SMEs used in the EU. If the definition is based on European legislation, it is first necessary to define an enterprise. An enterprise is considered “any entity engaged in an economic activity, regardless of its legal form.” The law defines microenterprises and SMEs as a group of enterprises with the following characteristics [8]:

• Employ less than 250 people;
• Their annual turnover does not exceed EUR 50 million;
• Their total annual balance sheet does not exceed EUR 43 million.

SMEs provide approximately 72% of the total employment in Slovakia, 67% of the total employment in the Czech Republic, 69% of the total employment in Hungary, and 68% of the total employment in Poland [20].

Many SMEs, due to their small size, lack of resources, tendency to independently manage complex activities, and limited understanding of risk management, resort to risk prevention. Thus, these SMEs may lose opportunities due to unstructured crisis management, which may exacerbate losses or transfer risks in liquidity-intensive situations [21,22]. An enterprise existing in an uncertain and ever-changing environment should be able to adapt in order to some compliance of its own objectives with the environmental conditions that may be a source of risk [23].

Risk management has become more important in recent decades. Businesses are realizing that their internal systems are more vulnerable without risk analysis and the implementation of appropriate risk management methods [24]. Risk management, especially in the area of SME management, is proving to be an important challenge [25]. Kovaľová [26] give the main reasons for the high vulnerability of SMEs to risks, such as outdated technology, low level of experience, insufficient capital, lack of managerial capacities, low utilization of existing capacities, and insufficient financial security of resources. According to the authors [27], research that focuses on risk analysis, risk identification, and the strategy of risk management implementation, as well as controls in the risk management process for SMEs, is needed. SMEs benefit from approaches that integrate risk management into other management processes, e.g., business or quality management, and strategic planning. Risk management is one of the most important practices affecting the competitiveness of SMEs and their innovation [28]. By implementing risk management, it is possible to increase the efficiency of these management systems. In addition to managers, risk management tools are also used by operating staff to ensure control over business processes that enable the smooth running of an enterprise [29]. According to Verbano and Venturini [30] and Kozubíková [31], risk management is addressed in large enterprises, with priority given to the manufacturing and financial sectors. According to Henschel [32], the size of the risk depends on the industrial sector. According to Lima [33], there are only a few studies on risk management in SMEs, and the general understanding of risk management in SMEs is not clear, especially for research, implementation, and practice.

It is precisely in the area of risk management that the emphasis is placed on not creating self-serving isolated systems, but on connecting it with the systems used by the organization. The risk management system is based on the assumption that risks (including their interrelationships and interactions) are assessed continuously, holistically, proactively, and systematically in the organization, and at the same time opportunities for process improvement are identified [34]. According to Hudáková [19], it cannot be a sequence of random activities of individual steps, but a continuous process with an established link to all operational activities. The risk management system is therefore a logically and functionally organized set of risk management elements and entities operating in a specific environment, connected by links and relationships of mutual conditionality, dependence, and continuity [35].

Part of the risk management system is the determination of the overall direction (policy), strategy, and goals of risk management. It is also necessary to harmonize the framework, principles, and structure, as well as to define the procedures and methods of the risk management process. Assigning responsibility to specific persons for activities in risk management is of great importance. Responsible persons (risk owners) must have clearly defined roles and authorities for all risk management processes. Last but not least, it is necessary to monitor all components of the risk management system, evaluate their effectiveness and efficiency, and constantly look for opportunities to improve them. The planning of the risk management system includes the commitment of top management and executives, the risk policy, the roles and responsibilities of risk managers for specific risks, and the management of resources in the field of risk management, etc. [13,19].

There is no doubt that organizations that have risk-related practices can mitigate the volatility of their revenues and reduce the impacts of financial crises in order to increase their performance [36,37]. SMEs do not have the same incentive to comply with risk standards as the size of their operations rarely requires strict adherence to standards similar to those of larger enterprises. In addition, many of the risks identified by these standards require immediate action by the enterprise; however, they are often not managed, leading to corporate vulnerability [20,38].

An enterprise operating as a system is managed by a functional or process approach, with the possibility of using project management. According to Henao-Calad [39], process management is a management method that systematically identifies business processes and their attributes and creates conditions for their effective course, coordination, measurement, and continuous improvement, resulting in a quality product integrating customer requirements and business strategy. Gosnik and Stubelj [40] state that the principle of process management is based on the maximum integration of activities between individual organizational units, where a fundamental innovation is the perception of the process as a whole. It is inconclusive whether the entire process occurs in one organizational unit or occurs across the entire enterprise. Nisar [41] and Saralaya [42] argue that the cause of potential problems in an organization is poorly designed and ongoing processes that need to be modified, and all activities that do not bring value to the customer should be eliminated. According to Stravinskiene and Serafinas [43], value arises in the processes that occur in an enterprise while monitoring the fulfillment of the interests and needs of customers, owners, and other interest groups of the enterprise. These conclusions are confirmed by Zuhaira and Ahmad [44], who argue that the prerequisite for successful business management is the systematic identification of processes; the definition of their sources, indicators, input and output requirements; and especially the knowledge of the risks of each process. The identification of risks in processes should be followed by the search for and evaluation of the impacts of the conditions that can affect business processes. All this must be used to design and implement effective preventive measures. Tubis and Werbinska-Wojciechowska [45] state that it is necessary to constantly assess the risks of key processes and identify the sources of risks that can cause failure with a negative impact on the reliability of processes. Wang and Wen [46] agree with this statement, arguing that it is necessary to create a process map and organize risk processes into a logical and clear structure.

At present, there are still enterprises that use management based on a functional approach focused on individual functions. Most organizational structures are based on the concept of functions and are organized based on specialists who perform specialized tasks. According to Szelagowski [47], this functional management creates several problems. Individual functions are locally limited, and there is destructive competition between individual functions and insufficient communication between departments, which, according to Vugec [48], causes much more risks in management than in the process approach.

In the current business environment, the issues of project management and risk management are increasingly interconnected. The increased interest is related to the growing number of implemented projects in individual enterprises worldwide. According to previous authors [49,50], the reasons are the growing needs to improve processes, to improve information technology, to change, and to secure funding for the business. The ever-changing environment puts pressure to introduce unique, specific changes in the organization, the purpose of which is to ensure the profits and growth of the enterprise. Willumsen et al. [51] state that properly implemented project management in conjunction with risk management can contribute to efficient resource management (financial, time and human), increase quality, and bring efficiency to production processes. Risk management helps project management achieve successful project completion at the right time, at the right cost, and with the right quality of project outputs [52].

Risks are an integral part of the operations of any enterprise. The most important impacts of risks are felt by SMEs, which are considered the most important part of the world economy and the engine of economic growth [53,54]. It should also be remembered that the dynamics and uncertainty of the business environment greatly complicate decision-making processes for enterprise executives and managers [55]. Most entrepreneurs try to identify risks, but risk is not related to their business processes such that they can manage and mitigate these risks. Most of the findings from previous studies show that every entrepreneur has an interpretation and assessment of risk that is relevant to his or her risk management activities and performance [56]. This explains why perception and ability to manage risk tend to be influenced by the accepted risk management approach [57,58]. Risk management, both in enterprises and in projects and processes themselves, should include key processes such as risk identification, risk analysis, risk assessment and the development of risk response strategies. Risk response strategies include the selection and implementation of effective measures to reduce risks and mitigate the adverse effects of adverse events. The need for an effective strategy, especially in SMEs, is very important, and the competitive advantage, as well as the performance of SMEs, depends on it. Improving competitive advantage also depends on the organization and its management system. Ensuring the performance of SMEs and effective management of corporate risks is the envy of the business strategy of the enterprise itself [59,60]. According to Rehman, [59] “SMEs face higher risks in terms of globalization as a result of their limited resources and small size”.

The theoretical background shows a summary of the perception of risk management by various authors. The perception of risk management varies and in various sources we can see the intermingling of risk management with other areas. Our theoretical contribution was the harmonization and merger of management systems, while we see risk management as an important area from which we start and take it as the key one in the management of SMEs. We focused on the business environment of SMEs within the Slovak Republic, as it is an area of our focus, and we focus on and will focus on giving further surveys. By implementing risk management, it is possible to increase the efficiency of these management systems. At the same time, the theoretical background is the starting point for statistical research as well as the creation of hypotheses and research questions, which are followed by the next chapter.

3. Development of Hypotheses

Every year, individual world organizations conduct various studies and surveys aimed at assessing the current state of the application of risk management and identifying the most serious business risks. According to a global study conducted by Protiviti [61], the most significant business risks identified in 2020 were the following: the risk of changes in legal requirements, the risk of changing economic impacts, the risk of reduced market entry, the risk of reduced digitization in an enterprise, weak resilience to change, and cyber threats, the risk of breach of personal data protection, the risk of an insufficient level of corporate culture, and the risk of lost customer loyalty and the inability to adopt new communication technologies in the field of marketing.

According to the ISACA [62], the most significant business risks facing businesses worldwide are the following: information and cyber risks (29%), reputational risks (15%), financial risks (13%), operational risks (12%), legal risks (8%), technological risks (6%), strategic risks (6%) and political risks (3%). The study shows that in the last year, attention to risk management has increased by up to 46% compared to the previous year. Top management (38%) and middle management (13%) pay the most attention to risk management, and managers at the operational level (9%) pay the least attention to risk management [62]. Delloite [63] states that in connection with the coronavirus pandemic, less than half of enterprises (46%) cited third parties as the most common cause of failure in their businesses, failing financially and being unable to pay their liabilities. According to enterprises, the financial impacts have increased up to fivefold compared to last year. Businesses perceived climate risks, environmental risks, personnel risks, financial risks, health and safety risks, and risk of data loss to be the most important risks [63]. MarshMcLennan [64] compared and assessed the considerable change in the three most significant risks identified over the years. In 2009, these risks were financial, macroeconomic, and strategic risks; in 2019, they were cyber, political, and strategic risks. In 2022, it is expected that these risks will be cyber, technological and strategic risks [65]. According to other global studies [61,63], the importance of applying risk management to prevent adverse events is expected to increase, increasing the need for managerial training in risk management.

The issue of corporate risk management has long been discussed not only in the world but also in EU countries. Like global organizations, organizations and universities in the V4 countries conduct various studies and research and process results assessing the current state of the application of risk management and the identification of the most serious business risks. In addition, the V4 countries have quite similar economic conditions and development, although the risks may be perceived differently [20].

According to Dankiewicz’s study [66], the most common risk faced by SMEs in Poland is personnel risk, which was most frequently mentioned risk by representatives of medium-sized enterprises (68%). The second type of risk that entrepreneurs perceive is legal risk. Market risks are perceived by enterprises operating in the market for more than 10 years (51.9%) and microenterprises (50%). Market risk is less pronounced for the services sector (43.2%) and medium-sized enterprises (44%). According to a study by Gavurova [65] for SMEs in the Czech Republic, the business environment is more demanding for microenterprises, which showed higher doses of pessimism in all evaluated areas compared with SMEs.

Within the V4 countries, the same research was conducted in 2017–2018 to identify the most serious business risks of SMEs. In Slovakia, the most serious risks identified were as follows: market risks at 26%, financial risks at 21%, economic risks at 19%, personnel risks at 11%, operational risks at 9%, legal risks at 7%, security risks at 6% and other risks at 1% [67]. In the Czech Republic, business owners and managers consider the most serious risks faced by SMEs, in particular as follows: market risks (24%), financial risks (19%), personnel risks (19%), economic risks (16%), operational risks (10%), legal risks (6%) and security risks (5%) [68]. In Poland, the most serious business risks identified were market risks (20%), financial risks (16%), personnel risks (15%), economic risks (14%), operational risks (12%), security risks (12%), and legal risks (11%) [69]. In Hungary, market owners and managers mainly consider market risks (19%) to be the most serious risks faced by SMEs, and market risks are followed by personnel risks (18%), financial risks (16%), economic risks (13%), operational risks (14%), security risks (11%), and legal risks (9%) [70]. Based on the processed research results in the V4 countries, it is possible to assess that the most serious business risks of SMEs that they identified are perceived similarly. SMEs in these countries have identified market risks, which are mainly associated with the use of products and services in domestic and foreign markets, as the biggest threat. The second, third, and fourth most serious risks were identified as financial, personnel, and economic risks. The order of these risks differed only slightly from one country to another [20].

Various foreign enterprises, e.g., The Project Management Institute, also focus their research on project risk management, which highlights its importance and the need to interconnect the research [71,72]. According to Berkley Risk [73], a global study of project risk management has identified the 10 most serious global risks faced by enterprises. In 4th place is the risk of shortening the time of project implementation (so-called tighter project schedule), in 5th place is a risk of increasing the complexity of projects, and in 8th place is insufficient use of project management tools [73]. According to other processed results from individual global studies [74,75,76], it is possible to evaluate that the most common cause of project failure is the inappropriately defined scope and goal of a project and the plans for individual resources. Furthermore, Klein and Müller [77] state that project managers mostly use a business plan as a tool, the obligatory part of which is the risk management within the preparatory phase of project implementation. Nevertheless, project managers do not sufficiently address this preparatory phase of project implementation and often identify risks based only on their own estimates and feelings. Persistent reasons for project failures are the insufficient analysis of project progress [78]. Many projects are not sufficiently monitored, and individual problems are not solved at the right time, which brings numerous financial losses for projects. Wellingtone [79] states that in up to 50% of cases, project managers do not follow the procedures of applying project risk management methods and techniques, which results in many problems occurring in projects. Similarly, project managers perceive numerous shortcomings in the application of project risk management [80]. Several authors [81,82] agree that this is because top management does not want to conduct project risk management, as it does not feel beneficial. Another factor is the insufficiently defined risk management policy in enterprises. According to a worldwide study [83], only 12% of enterprises have a proactive approach to project risk management. In these enterprises, according to the statements of managers, project risk management is at a very good level. Only 10% of enterprises require top management to review the risk reports from project managers; in 8% of the enterprises where project managers work, top management regularly reviews key project risks, with only 7.5% assessing these risks. In more than 49.24% of enterprises, top management does nothing in this area.

The requirements we have set for reasoning and building hypotheses are interconnected and condition each other. We carried out their separate assessment due to a better understanding of the essence of the problem; the intention was to preserve the continuity of the development of scientific knowledge and its enrichment with the obtained conclusions.

Given these facts and to verify the purposes of the article, the following hypotheses were formulated (H):

1.

H1: There are statistically significant differences in the risk management between SMEs according to the type of management (H1_A), age (H1_B) and size of SMEs (H1_C);

2.

H2: There are statistically significant differences in the perception of the three most significant business risks between SMEs according to the type of management (H2_A), age (H2_B) and size of SMEs (H2_C);

3.

H3: There are statistically significant differences in the ability of entrepreneurs to manage risk between SMEs according to the type of management (H3_A), age (H3_B) and size of SMEs (H3_C);

4.

H4: There are statistically significant differences in the use of risk mitigation measures in an enterprise between SMEs according to the type of management (H4_A), age (H4_B) and size of SMEs (H4_C).

To determine whether to accept or reject the statistical hypotheses formulated, the following research questions (Q) were formulated with the following possible answers:

5.

Q1: Do you address risk management in SMEs? Answers: yes, sometimes, no.

6.

Q2: Which of the following risks do you currently consider key in SMEs? The maximum number of answers was 3. Answers: security risk (SR: e.g., injury, PC virus, or dangerous working environment), economic risk (ER: e.g., rise in energy and raw material prices or exchange rate changes), financial risk (FR: e.g., threat of insolvency or an imbalance in the proportions of own and foreign resources of the enterprise), business risk (BR: e.g., in-creased competition or insufficient marketing), personal risk (PR: e.g., unskilled employ-ees or employee turnover), legal risk (A6: e.g., changes in laws), market risk (MR: e.g., in-sufficient sales or demand), other risks (OR: possibility for respondents to indicate other risks).

7.

Q3: Do you think you can manage the risks in your business? Answers (A): yes, and therefore nothing has happened to us (A1), yes, we train employees according to the re-quirements of the law (A2), yes, we create financial reserves in the enterprise for unex-pected events (A3), no, we do not perceive threats (A4).

8.

Q4: What risk reduction measures do you use? The maximum number of answers was 3. Answers (A): financial reserves (A1), insurance (A2), flexibility (A3), risk avoidance (A4), risk reduction (A5), risk diversification (A6), expansion of the production program (A7), risk sharing (A8), risk transfer to a trading partner (A9), and otherwise (A10).

9.

The research problem is to find answers to research questions and to strengthen existing findings in order to bridge the knowledge gap in solving problems centered on SMEs’ ability to manage business risks in specific conditions, as well as to identify key risks for SMEs and opportunities to mitigate them.

4. Methodology

To evaluate the aim of the article, the primary data from the business environment of SMEs in the Slovak Republic were collected. Data collection was conducted in the period from 9/2019 to 9/2020 using an online questionnaire. Only the owners or top managers of the SMEs (hereinafter referred to as the respondents) could complete the questionnaire. To increase the reliability of the questionnaire, a targeted selection of respondents was conducted through contact persons (in person), by telephone and by e-mail. The request to complete the questionnaire was addressed to 500 respondents (the number of respondents was determined based on the application of sample size analysis). The questionnaire (22 questions—100%) was divided into the following parts: (i) demographic data of the respondents (questions nos. 1–5), (ii) business management (questions nos. 6–10), (iii) risk management (questions nos. 11–15), (iv) causes of project failure (questions nos. 16–22).

The total number of completed questionnaires was 396 (362 (91.4%) were fully completed questionnaires, and 34 (8.6%) were incomplete questionnaires). Incomplete questionnaires were excluded from further empirical evaluation. The return rate of the questionnaire was 79.2% (396 completed questionnaires). The results of the reliability of the questionnaire were more than 0.9 for each question (Cronbach’s alpha).

4.1. Approach

All performed calculations were carried out in statistical software for data analysis—SPSS Statistics version 25.

Pearson’s chi-squared test (hereinafter referred to as the “Chi-square test”) was applied to discover statistically significant differences among the selected groups of respondents based on the formulated questions according to the criteria; see, e.g., Chi-square test is used to detect statistically significant differences between two or more sample groups. Even before the above-mentioned tests were applied, descriptive statistics tools were used (descriptive characteristics—absolute and relative frequency). Their contribution consists of: (a) in presenting the basic structure of respondents’ answers to selected statements; (b) in their subsequent use in the application of tests. To determine descriptive statistics of selected risks, according to selected criteria, a simple sorting method was used—sorting according to two statistical signs. The results are summarized in clear contingency tables. The formula for calculating the test criterion (TK) for the Chi-square test can be found in several scientific, professional, and educational publications. When calculating the TK for Chi-square itself, it is necessary to calculate the expected (theoretical) frequencies. The prerequisite for applying the Chi-square is the necessity that all groups of respondents meet the minimum required expected frequency of 5. The critical testing area was determined based on the significance level of the test and the number of degrees of freedom. The level of significance (α) was set at the level of 0.05 (5%). The number of degrees of freedom (v) is determined as the product of (r-1) and (s-1), where (r-1) is the number of variations of the first statistical feature minus one and (s-1) is the number of variations of the second statistical feature minus one. If the calculated value of the test criterion is lower than the critical area of testing, then the statistical hypothesis cannot be rejected. Chi-square was used to determine whether there are statistically significant differences in the attitudes of respondents to selected statements according to the chosen criterion. The statistical method is suitable considering the scaling of the attitudes of sample sets of respondents [84].

A pivot table was calculated for each question (Q1,…, Q4) using descriptive statistics (absolute and relative frequencies). To determine the descriptive characteristics, the simple sorting method—sorting based on two statistical characters (research criterion and type of response to the question)—was used. The assumption of using the chi-squared test was verified for each test—the expected frequency [85]. If the calculated p value of the chi-squared test was less than the significance level, then the hypothesis was confirmed [86]. Evaluation of hypotheses according to the Chi-square test was verified also using a non-parametric approach (N.A.). The Z-test method was used to discover statistically significant differences in respondents’ answers according to the selected criterion. If the p value of the Z-test for 2 population proportions was less than the significance level (0.05), then the hypothesis was confirmed [87]. All calculations were performed using SPSS Statistics statistical software.

4.2. Demographic Structure of the Sample of Respondents

The demographic structure of the selected sample of respondents (n = 362) is as follows. Regarding the number of employees in the enterprise, 235 (64.9%) are from a microenterprise, 73 (20.2%) are from a small enterprise, and 54 (14.9%) are from a medium-sized enterprise. Regarding the business sector, 96 (26.5%) are from the engineering industry, 91 (25.1%) are from business and financial services, 67 (18.5%) are from construction, 46 (12.7%) are from accommodation and food service activities, 26 (7.3%) are from transport, 25 (6.9%) are from another industry (e.g., education, counseling, etc.), and 11 (3.0%) are from agriculture. Regarding the business region, 130 (35.9%) are from western Slovakia (regions: Bratislavský, Trnavský, Trenčiansky, and Nitriansky), 208 (57.5%) are from central Slovakia (regions: Žilinský and Banskobystrický), and 54 (6.6%) are from eastern Slovakia (regions: Košický and Prešovský). Regarding the operating period of the enterprise in the business environment, 74 (20.5%) are from enterprises with up to 5 years of business operations, 112 (30.9%) are from enterprises with 5 to 10 years of business operations, and 176 (48.6%) are from enterprises with 10 and more years of business operations. Regarding the type of business management, 272 (75.1%) engage in the process management of the enterprise, 51 (14.1%) engage in the project management of the enterprise and 39 (10.8%) engage in the system management of the enterprise.

5. Results

The results below confirm the reliability and validity; for the critical values, see, e.g., [88,89] of the analyzed data (CA—Cronbach’s alpha, FL—factor loading, CR—composite reliability, and AVE—average variance extracted): factor—risk management; item—Q1,…, Q4; FL: Q1 = 0.841, Q2 = 0.759, Q3 = 0.891, and Q4 = 0.947; CA = 0.811; CR = 0.920; and AVE = 0.744.

The results of the empirical study show that 140 (38.7%) respondents are engaged in all risk management activities (identification, analysis, evaluation, monitoring, and creation of reduction measures). Conversely, 56 (15.5%) respondents stated that they do not engage in any risk management activity. The other SMEs (156, 43.1%) are engaged in the following main activities of risk management: risk identification (28, 7.7%), risk analysis (33, 9.1%), risk assessment (28, 7.7%), and creating measures to reduce (42, 11.6%) and monitor risks (35, 9.7%).

5.1. Addressing Risk Management in the Enterprise

The evaluation of the question focused on addressing risk management in SMEs (question Q1) is as follows: 92 (24.4%) of the respondents answered yes, 114 (31.5%) of the respondents answered sometimes and 156 (43.1%) of the respondents answered no. The contingency table contains the classification of respondents according to Q1 and selected research criteria (see

Table 1. Disparities in risk management.

Q1	Type of Assessment			Age of Enterprise			Size of Enterprise
	Proc.	Proj.	S	<5	>5, <10	>10	Mic.E	SM	Med.E
Yes %	65 23.9	13 25.5	14 35.9	15 20.3	33 29.4	44 25.0	47 20.0	28 38.4	17 31.5
Sometime %	82 30.1	21 41.2	11 28.3	25 33.8	30 26.8	61 34.7	75 31.9	21 28.8	18 33.3
No %	125 46.0	17 33.3	14 35.8	34 45.9	49 43.8	71 40.3	113 48.1	24 32.8	19 35.2
SUM %	272 100	51 100	39 100	74 100	112 100	176 100	235 100	73 100	54 100
CH.T.	5.855 (0.210)			3.358 (0.500)			12.458 (0.014)
N.A.	8.271 (0.197)			9.664 (0.117)			13.174 (0.009)

Note: Proc.—process, Proj.—project; S—systematic; Mic. E—microenterprise; SM—small enterprise; Med. E—medium enterprise; <5—age of the enterprise is less than 5 years; >5, <10—age of the enterprise is more than 5 years and less than 10 years; >10—age of the enterprise is more than 10 years; and CH.T.—Chi-squared test (p value). Source: own research.

).

The results (see Table 1) show that the type of business management and the age of the enterprise are not significant criteria that affect the risk management in SMEs in the business environment of the Slovak Republic (type of assessment: p value of the chi-squared test = 0.210, and age of the enterprise: p value of the chi-squared test = 0.210). However, Table 1 shows that the size of the enterprise is an important criterion (p value of the chi-squared test = 0.014). Hypotheses H1_A and H1_B were rejected. Hypothesis H1_C was confirmed.

Small enterprises (38.4%) and medium-sized enterprises (31.5%) were statistically significant (SM: Z-test = −3.192, and p value = 0.001; Med. E: Z-test = −1.992, and p value = 0.048), and they are more involved in risk management than microenterprises (20.0%).

5.2. Perception of Key Risks in Businesses

The evaluation of the issue of the perception of the key risks in SMEs (question Q2) is as follows: 209 (57.7%) of the respondents answered economic risk, 180 (49.7%) of the respondents answered market risk, 176 (48.6%) of the respondents answered business risk, 142 (39.2%) of the respondents answered personal risk, 135 (37.3%) of the respondents answered security risk, 127 (35.1%) of the respondents answered financial risk, 76 (21.0%) of the respondents answered legal risk and 13 respondents answered other risks.

Table 2. Disparities in the perception of the key risks in businesses.

Q2	Type of Assessment			Age of Enterprise			Size of Enterprise
	Proc.	Proj.	S	<5	>5, <10	>10	Mic.E	SM	Med.E
ER (%)	159 58.5	32 62.7	18 46.2	45 60.8	78 69.6	86 48.9	131 55.7	44 60.3	34 63.0
MR (%)	152 55.9	18 35.3	10 25.6	51 68.9	51 45.5	78 44.3	124 52.8	31 42.5	25 46.3
BR (%)	123 45.2	26 51.0	27 69.2	43 58.1	58 51.8	75 42.6	131 55.7	28 38.4	17 31.5
PR (%)	101 37.1	27 52.9	14 35.9	21 28.4	50 44.6	71 40.6	71 30.2	36 49.3	35 64.8
SUM	272	51	39	74	112	176	235	73	54
CH.T.	16.751 (0.010)			10.937 (0.090)			24.047 (<0.001)
N.A.	19.188 (0.003)			9.173 (0.129)			39.087 (<0.001)

Note: Proc.—process; Proj.—project; S—systematic; Mic. E—microenterprise; SM—small enterprise; Med. E—medium enterprise; <5—age of the enterprise is less than 5 years; >5, <10—age of the enterprise is more than 5 years and less than 10 years; >10—age of the enterprise is more than 10 years; ER—economic risk; MR—market risk; BR—business risk; PR—personal risk; and CH.T.—Chi-squared test (p value). Source: own research.

contains the classification of the respondents according to Q2 and the selected research criteria.

The results (see Table 2) show that the type of business management and the size of the enterprise are important criteria that affect the perception of the key risks in businesses (type of assessment: p value of the chi-squared test = 0.010, and size of the enterprise: p value of chi-squared test < 0.001). However, the results show that the age of SMEs was not a significant criterion (p value of the chi-squared test was higher than 0.05). Hypotheses H2_A and H2_C were accepted. Hypothesis H2_B was rejected.

Small enterprises (49.3%) and medium-sized enterprises (64.8%) were statistically significant (SM: Z-test = −2.994, and p value = 0.003; Med. E: Z-test = −4.758, and p value = 0.000) and perceive personnel risk in SMEs more than microenterprises (30.2%). SMEs with process (37.1%) business management statistically significantly (Proc: Z-test = −2.118, and p value = 0.034) perceive personnel risk in businesses to a lesser extent than SMEs with project management (52.9%). Conversely, SMEs with process (55.9%) business management statistically significantly (Proc: Z-test = 2702, and p value = 0.007) perceive market risk in businesses more than SMEs with project management (35.3%).

5.3. Ability to Manage the Risks of Owners or Top Managers

The evaluation of the question on the ability of owners or top managers to manage risks (question Q4) is as follows: 42 (11.6%) of the respondents answered A1, 124 (34.2%) of the respondents answered A2, 127 (35.1%) of the respondents answered A3, and 69 (19.1%) of the respondents answered A4.

Table 3. Disparities in the ability to manage risks in SMEs.

Q3	Type of Assessment			Age of Enterprise			Size of Enterprise
	Proc.	Proj.	S	<5	>5, <10	>10	Mic.E	SM	Med.E
A1 %	34 12.5	8 15.7	6 15.4	13 17.8	9 8.0	20 11.4	36 15.4	6 8.2	5 9.3
A2 %	88 32.4	18 35.3	12 30.8	11 15.1	38 33.9	75 42.6	59 25.1	29 39.7	31 57.4
A3 %	106 39.0	9 17.6	12 30.8	35 47.9	47 42.0	45 25.6	88 37.4	27 37.0	12 22.2
A4 %	44 16.1	16 31.4	9 23.0	14 19.2	18 16.1	36 20.5	52 22.1	11 15.1	6 11.1
SUM %	272 100	51 100	39 100	74 100	112 100	176 100	235 100	73 100	54 100
CH.T.	12.007 (0.065)			25.228 (<0.001)			24.640 (<0.001)
N.A.	21.188 (<0.001)			31.111 (<0.001)			39.087 (<0.001)

Note: Proc.—process; Proj.—project; S—systematic; Mic. E—microenterprise; SM—small enterprise; Med. E—medium enterprise; <5—age of the enterprise is less than 5 years; >5, <10—age of the enterprise is more than 5 years and less than 10 years; >10—age of the enterprise is more than 10 years; A1—yes, and therefore nothing happened to us; A2—yes, we train employees according to the requirements of the law; A3—yes, we create financial reserves in the enterprise for unexpected events; A4—no, we do not perceive threats; and CH.T.—Chi-squared test (p value). Source: own research.

contains a classification of the respondents according to Q3 and the selected research criteria.

The results (see Table 3) show that the age and size of the enterprise are important criteria that affect the ability to manage risks in SMEs (p values of chi-squared tests are less than the significance level). The results show that the type of SME management was not a significant criterion (p value of the chi-squared test = 0.065). Hypothesis H3_A was rejected. Hypotheses H3_B and H3_C were accepted.

Enterprises with more than 5 years in the business environment (>5, <10: 33.9% and >10: 42.6%) are statistically significant (>5, <10: Z-test = −2.889, and p value = 0.004; >10: Z-test = −4.216, and p value = 0.000) and are better able to manage risks because they train their employees compared to enterprises with up to 5 years in business (15.1%). Enterprises with up to 10 years in the business environment (<5: 47.9% and >5, <10: 42.0%) are statistically significant (<5: Z-test = −3.362, and p value = 0.000; >5, <10: Z-test = 2.909, and p value = 0.004) and are better able to manage risks because they create financial reserves for unexpected events compared to enterprises with more than 10 years in business (25.6%).

5.4. Use of Risk Reduction Measures in SMEs

SMEs use the following risk reduction measures (question Q4): 207 (57.2%) of the respondents answered A1, 176 (48.6%) of the respondents answered A2, 162 (44.8%) of the respondents answered A3, 154 (42.5%) of the respondents answered A4, 98 (27.1%) of the respondents answered A5, 82 (22.7%) of the respondents answered A6, 65 (18.0%) of the respondents answered A7, 62 (17.1%) of the respondents answered A8, 29 (8.0%) of the respondents answered A9 and 32 (8.8%) of the respondents answered A10.

Table 4. Disparities in the use of risk reduction measures.

Q4	Type of Assessment			Age of Enterprise			Size of Enterprise
	Proc.	Proj.	S	<5	>5, <10	>10	Mic.E	SM	Med.E
A1 (%)	168 61.8	19 37.3	20 51.3	48 64.9	60 53.6	99 56.3	147 62.6	35 47.9	25 46.3
A2 (%)	129 47.4	30 58.8	17 43.6	26 35.1	60 53.6	90 51.1	113 48.1	34 46.6	29 53.7
A3 (%)	128 47.1	16 31.4	18 46.2	30 40.5	60 53.6	72 40.9	100 42.6	41 56.2	21 38.9
A4 (%)	108 39.7	25 49.0	21 53.8	25 33.8	46 41.1	83 47.2	104 44.3	33 45.2	17 31.5
SUM	272	51	39	74	112	176	235	73	54
CH.T.	10.437 (0.107)			8.150 (0.228)			6.862 (0.334)
N.A.	9.271 (0.174)			4.551 (0.317)			3.174 (0.609)

Note: Proc.—process; Proj.—project; S—systematic; Mic. E—microenterprise; SM—small enterprise; Med. E—note: Proc.—process; Proj.—project; S—systematic; Mic. E—microenterprise; SM—small enterprise; Med. E—medium enterprise; <5—age of the enterprise is less than 5 years; >5, <10—age of the enterprise is more than 5 years and less than 10 years; >10—age of the enterprise is more than 10 years; A1—financial reserves; A2—insurance; A3—flexibility; A4—risk avoidance; and CH. T.—Chi-squared test (p value). Source: own research.

classifies respondents according to the four most important risk reduction measures and the selected research criteria.

The results (see Table 4) show that the research criteria (type of business management, size, and age of the enterprise) are not significant criteria. The research criteria did not affect the use of risk reduction measures in SMEs (p values of the chi-squared tests were higher than the significance level). Hypotheses H4_A, H4_B, and H4_C were rejected.

6. Discussion

The negative surprising result of the case study is that only approx. 40% of SMEs are actively involved in all risk management activities. First, it is necessary to examine the causes (e.g., reluctance, financial background, and ignorance) and negative consequences of the facts (bankruptcy of SMEs, negative financial indicators of SMEs, and redundancies). Second, the conclusions are an opportunity to better promote the importance of risk management in the SME segment. In this context, several authors such as Hrabal [90] and Belás [91] argue that SME owners are the ones on whom the final attitude of SMEs toward risk management depends.

According to SMEs, economic risk (49.7%) and market risk (48.6%) are the most significant risks that have a negative effect on the business environment in the Slovak Republic. These conclusions consistently follow the findings and perceptions of Madrid-Guijarro [92] and Lee [93]. In a sample of 193 SMEs in the Slovak Republic, Ivanová [84] found that enterprises have difficult access not only to external sources of financing in the form of bank loans but also to funds and grants from the European Union. Kotaskova [94] states that other countries of the V4, except Hungary, face similar problems. However, the financial and market problems of SMEs are not only a Central European problem [95,96]. Bertoni et al. [97] argue that the impact of state-supported participatory loans on the growth of business activities is enormous. Project-driven and process-driven SMEs are more likely to perceive the effects of economic and market risk than systemically managed SMEs. The size of the enterprise is also a significant factor. In contrast, differences in risk perception according to the age of the enterprise are not significant. This finding contrasts with Lazanyi [98]. In a sample of 1141 SMEs from the Czech Republic, they found that the age of the enterprise is a significant factor in the perception of business risks.

The SME owners/top managers confirmed significant disparities in the subjective evaluations of the ability to manage risks. Age, size, and type of SMEs are important factors in business management. The characteristics of an enterprise that does not perceive a threat (does not manage risks in the enterprise) are as follows: a microenterprise with project management that has been operating for up to 5 years in a business environment. Conversely, the characteristics of an enterprise that manages risks (creates financial reserves) are as follows: a medium-sized enterprise with systematic management and over 10 years operating in the business environment of the Slovak Republic.

The results show that there were no significant differences in risk reduction methods between SMEs in terms of age, size, and type of SMEs. Respondents provided the three most frequently implemented methods: insurance (57.2%), flexibility (48.6%) and risk avoidance (55.8%). However, the least used risk reduction methods are, according to the selected sample of respondents, risk sharing (8.0%) and risk transfer to a business partner (8.8%). Watanabe et al. [93] state that spending funds on risk reduction is a major problem in traditional management practices. Evaluating the justifications for the use of funds is crucial for the effective management of SMEs [99]. When applying risk treatment, an enterprise must remember the knowledge gained from the risk assessment; in addition, risk treatment must be part of the business resources and risk appetite of stakeholders. To help enterprises find a compromise where the risks are in line with the returns, certain strategies can be applied based on their specificities. It is constantly confirmed that SME owners’ approach is reactive and not preventive. For example, the steps taken to minimize risks have always occurred after the risk has already occurred. In short, risk management in SMEs depends entirely on the experience of the SME owner, who is himself a risk. The SME risk management model assumes that the SME owner will provide the central processes or resources needed to continue operating in the event of a loss. However, many SMEs cannot always cover insurance costs due to their limited size and inability to adequately generate a source of income for the SME owner that justifies the opportunity costs [15].

6.1. Theoretical, Policy, and Practical Implications

The achieved results are a source of information for several segments of the business environment. Due to the fragility (background, financial, and personnel stability) of SME businesses, the conclusions are inspiring for the owners themselves or the top managers of SMEs. Awareness of their perception of risks and their management compared with other SMEs in a given segment can bring inspiring ideas, new opportunities for enterprises, or streamlining of the given risk management process. No less important beneficiaries are businesses and educational organizations. Given the identified disparities in risk management (type of project management, age, and size of SMEs), these organizations can better assess the needs of their potential customers and create courses, seminars, workshops, and tailor-made materials for selected groups of SMEs [100]. The results can serve as a basis for government institutions and other organizations addressing the quality of the business environment and risk management. These institutions are the creators of the strategic documents, regulations, and decrees that support the development and innovation of SMEs.

Buganová and Šimíčková [101], who studied this issue in Slovakia and the Czech Republic, declare that the application of project risk management is insufficient compared to global results, so many projects end in failure. The results of studies [83] in Slovakia and the Czech Republic confirmed that in more than 66% of enterprises in which project risk management is insufficiently applied, there are budget overruns, noncompliance with schedules, and schedule resource management. According to Masar and Hudakova [83], another reason for project failure, which appears in the conditions of the Slovak Republic, is the change in the scope of a project and insufficient support from the top management. Many managers master the theoretical process of applying the risk management process but are unable to actively use them in a general form, even many times in their modified form.

6.2. Future Research Directions

The survey is based on and follows from Hudakova studies [67], whereas the purpose of the survey was to identify risk factors within SMEs. The purpose of the survey is to strengthen the resilience of SMEs and identify risks that could affect their resilience. In the next phase of the research, attention will be given to SMEs that apply risk avoidance, financial reserves, and flexibility as methods used to reduce risks. These SMEs will be contacted again with a request to recomplete the questionnaire and will be asked for deeper analysis of risk management and the perception of their possible negative consequences for SMEs. At the same time, we are focusing the next direction of research on the interruption of business as a result of the COVID-19 pandemic and identifying the impact of the pandemic on SMEs in the Slovak Republic. The intention is to identify possible problems that have arisen for SMEs during the pandemic and to support the increase in resilience and continuity within SMEs.

7. Conclusions

The aim of this article was to identify the disparities in the management and risk management of SMEs depending on the type of management, age and size of SMEs in the business environment of the Slovak Republic.

The empirical results show that only 38.7% of SME owners and managers are involved in all risk management activities (including the identification, monitoring, design and implementation of risk reduction measures in SMEs). Furthermore, 43.1% of SMEs do not conduct risk management. The age and type of SMEs are not significant factors. Microenterprises are more concerned with risk management than SMEs. The three most significant risks in doing business according to owners and top managers are economic risk (57.7%), market risk (48.6%), and business risk (39.2%). The type of management and the size of the enterprise are important factors, and there are significant differences in the perception of key risks. Thirty-five percent of the addressed owners/managers stated that they are able to manage risks because they create financial reserves for unforeseen events in SMEs. Financial reserves, insurance, and flexibility are among the three most commonly used risk reduction measures in SMEs. Disparities according to the research criteria are not statistically significant.

The case study was conducted during 2019 and 2020, and thus the perceptions of the owners and top managers could be significantly affected by the uncertainty associated with the COVID-19 pandemic. Another limit is the relatively small size of the business environment of one Central European country with strong ties to the automotive industry. While the applied statistical methods are easy and clear to interpret, there was a need to verify them using nonparametric tests.